Modern data centers may have thousands of host computer systems that operate collectively to service requests from even larger numbers of remote clients in relation to performance data and diagnostic information (e.g., “logs”) that can be analyzed to quickly diagnose performance problems. In order to reduce the size of this performance data, the data is typically pre-processed prior to being stored based on anticipated data-analysis needs. For example, pre-specified data items can be extracted from the performance data and stored in a database during a data ingestion phase to facilitate efficient retrieval and analysis later at search time. Conventionally, the performance data is not saved in raw form and is essentially discarded during pre-processing. As such, it may be impossible to do analysis later on for items that are not anticipated up front and therefore are not added as pre-specified data items since the discarded raw data is no longer available after data ingestion.